Microsoft 365 user offboarding checklist: mailbox, OneDrive and licences

To offboard a Microsoft 365 user safely, work in this order: reset the password and end all sessions, block sign-in, preserve the mailbox and OneDrive content, wipe mobile devices, set up forwarding or a shared mailbox, then remove the licence and only at the end delete the account. Doing it in that order means the leaver loses access immediately while the data stays recoverable for the people who take over their work.

This checklist follows Microsoft's "Remove a former employee" guidance and adds the PowerShell commands, the traps and the error messages that show up in practice.

Who this is for and what you will have at the end

This guide is for IT administrators who handle joiner, mover and leaver requests in a Microsoft 365 tenant, whether the account is cloud-only or synchronised from Active Directory. Most steps can be done with the User Administrator role; the role table below lists the exceptions.

At the end you will have:

• A leaver's access ended within roughly an hour and blocked going forward.
• Their mailbox kept as a shared mailbox, forwarded, or exported, according to what the business needs.
• Their OneDrive files moved or shared with a manager before the retention clock runs out.
• A licence released, and the account deleted at a point where nothing still depends on it.

Prerequisites

Roles

Microsoft's documentation names different roles for different steps. Pick the narrowest one per task rather than using Global Administrator.

For a deeper look at choosing roles, see least-privilege Entra admin roles.

Decide before you start

Answer these questions with the leaver's manager first, because each answer changes the steps below:

1. Does anyone need the mailbox content, and for how long?
2. Do customers or partners still email the address?
3. Is the user subject to any legal or compliance hold?
4. Who should receive the OneDrive files?
5. Is the account synchronised from on-premises Active Directory?

Step 1: End access immediately

The first step is to stop the leaver using any session they already have. Microsoft's order is reset the password, sign out of all sessions, then block sign-in.

Reset the password and sign out of all sessions

1. In the Microsoft 365 admin center, go to Users > Active users.
2. Select the user, then select Reset password. Choose whether to generate a password automatically and whether to require a change at first sign-in, then select Reset password and Close.
3. Select the user again and, on the Account tab, select Sign out of all sessions.

Within an hour, or after the user leaves the page they are on, they are asked to sign in again. This takes time because an access token is good for an hour. Outlook on the web is the usual surprise: the user may stay in their mailbox until they select a different tile such as OneDrive, or refresh the browser.

For an immediate result from a script, revoke the refresh tokens with Microsoft Graph PowerShell. The cmdlet invalidates all refresh tokens issued to applications for the user and session cookies in the user's browser by resetting the signInSessionsValidFromDateTime property.

Connect-MgGraph -Scopes 'User.RevokeSessions.All'
Revoke-MgUserSignInSession -UserId '[email protected]'

A UPN can be used as -UserId. User.RevokeSessions.All is the least privileged permission listed for this cmdlet.

Block sign-in

1. In Users > Active users, select the user and choose Block sign-in.
2. Select Block this user from signing in and Save changes.

Microsoft notes that blocking can take up to 24 hours to take effect, which is why the password reset comes first: it prevents sign-in straight away.

Block mailbox protocols in Exchange Online

Optionally, close each mailbox access path in the Exchange admin center:

1. Go to Recipients > Mailboxes and select the mailbox.
2. Under Email apps & mobile devices, select Manage email apps settings.
3. Turn off Outlook desktop (MAPI), Exchange web services, Mobile (Exchange ActiveSync), IMAP, POP3 and Outlook on the web, then select Save.

Choosing the right way to end an email session

Exchange sessions respond differently to each action. Microsoft's table of options is worth keeping nearby:

Where you make the change affects how fast it lands: within about 30 minutes in the Exchange admin center or PowerShell, about 60 minutes in the Microsoft Entra admin center, and 3 hours or more when done on-premises.

Hybrid and synchronised accounts

If the account is synchronised from on-premises Active Directory, make the change on-premises as well. Otherwise Microsoft Entra Connect can overwrite a change you made in the Entra or Exchange admin center. You also cannot delete or restore a synchronised user in the Microsoft 365 admin center; that happens in Active Directory.

Step 2: Preserve the mailbox

Microsoft describes two ways to save a former employee's mailbox content, plus conversion to a shared mailbox in a later step.

Option A: holds and inactive mailboxes

If litigation is possible, place a litigation hold or in-place hold on the mailbox before you delete the account. After the account is deleted, the mailbox becomes an inactive mailbox that compliance staff can search with eDiscovery tools. Inactive mailboxes cannot receive email and are not shown in the shared address book.

Two cautions from Microsoft's guidance:

• Before you remove a licence, you must remove any holds for the user.
• A mailbox that needs a hold must be assigned an Exchange Online Plan 2 licence, or Plan 1 plus an Exchange Online Archiving add-on, so the hold can be applied before deletion.
• Forwarding and shared-mailbox conversion do not work when the mailbox is inactive for compliance reasons.

For the difference between holds and retention policies, see litigation hold vs retention policy in Exchange.

Option B: export to a .pst file

Add the mailbox to a desktop Outlook profile and export emails, contacts and calendar items to a .pst file. You can import that file into another person's mailbox later. This is simple but manual, and the file leaves the service, so store it somewhere governed.

Step 3: Wipe and block mobile devices

If the leaver had a work phone or tablet with Exchange ActiveSync access:

1. In the Exchange admin center, go to Recipients > Mailboxes.
2. Select the user and, under Email apps & mobile devices, select Manage mobile devices.
3. On Mobile Device Details, select a device, choose an option such as Account Only Remote Wipe Device, then select Block access.
4. Save your changes.

If the device is managed through Basic Mobility and Security, wipe it there instead.

Step 4: Forward email or convert to a shared mailbox

Forwarding and shared mailboxes both depend on the user account existing. Do not delete the account if you choose either one.

Convert to a shared mailbox

1. In Users > Active users, select the user.
2. On the Mail tab, select Convert to shared mailbox and select Convert.
3. If the mailbox is under 50 GB, remove the user's licence. Do not delete the account.

Points to know:

• The mailbox must still have a licence when you convert it; otherwise the option does not appear. If you removed the licence earlier, add it back first.
• Without a licence, a shared mailbox is limited to 50 GB. An Exchange Online Plan 2 licence raises the limit to 100 GB.
• Inbox rules are preserved.
• If you do not reset the password, the original username and password continue to work on the shared mailbox, so reset it in Step 1.

If you already deleted the account, restore it, assign a licence, reset the password, wait up to 24 hours for the mailbox to be recreated, then remove the licence and add members. The longer walkthrough is in converting a user mailbox to a shared mailbox.

Forward to another employee

1. In Users > Active users, select the user and open the Mail tab.
2. Under Email Forwarding, select Manage email forwarding.
3. Select Forward all emails sent to this mailbox, enter the forwarding address and decide whether to keep a copy in the original mailbox.
4. Select Save changes.

Cancel the leaver's meetings

Cancel meetings the former user organised so attendees can remove them. Rooms and equipment they booked stay unavailable until those meetings are cancelled.

Step 5: Give someone access to OneDrive

If you delete the account, OneDrive content is kept for 30 days by default. If you only remove the licence and do not delete the account, you can still reach the content after 30 days. Either way, do not leave it to chance.

Copy files out

1. In Users > Active users, select the user and choose OneDrive.
2. Under Get access to files, select Create link to files.
3. Open the link, then download the files or use Move to or Copy to to place them in your OneDrive or a shared library.

When you move or copy documents that have version history, only the latest version moves. Admin options for an active user under the OneDrive tab are not supported for multi-geo tenants.

Give a manager access

1. Sign in as a SharePoint admin and open the SharePoint admin center from Admin centers in the navigation pane.
2. Select More features, then under User profiles select Open.
3. Under People, select Manage User Profiles, find the former employee and select Find.
4. Right-click the account, choose Manage site collection owners and add the new user as a site collection administrator.

To remove that access later, return to the same dialog and remove the person.

Change the retention period

In the SharePoint admin center, under Settings, select Retention and enter a value from 30 through 3650 in Days to retain files a deleted user's OneDrive. The setting applies to the next deleted user and to users already being deleted, and the count starts when the account was deleted in the Microsoft 365 admin center. See OneDrive access after a user leaves for more scenarios.

Step 6: Remove the licence

Remove licences only after any holds are released and after the mailbox has been converted, if you are converting it.

1. In Users > Active users, select the user and open Licenses and Apps.
2. Clear the check boxes for the licences to remove and select Save changes.

When you remove a licence, the user's data is held for 30 days, and you can still access it or restore the account. After 30 days the content, except documents stored in SharePoint, is permanently deleted and cannot be recovered. If the account is not deleted, OneDrive content stays reachable.

To stop paying for the seat, go to Billing > Your products, select the subscription, select Remove licenses, and choose when the change takes effect and the new total quantity.

Phone numbers

If the organisation uses PSTN calling, removing the licence releases the user's calling number for reuse. Remove the user from call queue groups, and use a Teams calling policy if calls to their number should be forwarded.

Step 7: Delete the account

Delete the account last, and only if nothing depends on it.

1. In Users > Active users, select the former employee.
2. Select Delete user, choose the options shown and select Delete user.

The account becomes inactive for approximately 30 days, during which you can restore it. After that it is permanently deleted.

For a cloud-only account you can use Graph PowerShell. Deleting moves resources, including the mailbox and licence assignments, to a temporary container; restoring within 30 days brings them back, along with the user's group memberships.

Connect-MgGraph -Scopes 'User.DeleteRestore.All'
Remove-MgUser -UserId '[email protected]' -Confirm

Run with -WhatIf first if you want to confirm the target. Synchronised accounts must be deleted in Active Directory instead.

Verification

After you finish, check each item rather than assuming:

• Sign in attempts for the user fail, and the user shows as blocked in Active users.
• Sign-in logs show no successful sign-ins after your cutoff time.
• Sending a test message to the old address reaches the shared mailbox or the forwarding recipient.
• The manager can open the former OneDrive and the needed files are copied.
• The licence count under Billing > Your products matches what you expect.
• For a deleted user, you can still restore the account until the roughly 30-day window ends.

Troubleshooting

The Convert to shared mailbox option is missing

The mailbox has no licence. Assign a licence, wait for the mailbox to be provisioned, and convert it. After conversion you can remove the licence if the mailbox is under 50 GB.

Mail to the old address bounces after deletion

Deleting the account stops messages sent to it from being received. This is expected. Restore the account within 30 days and convert the mailbox to a shared mailbox if the address must keep receiving mail.

Forwarding or conversion does nothing

If the mailbox is inactive because of a compliance hold, forwarding and shared mailbox conversion do not work. Use the hold and eDiscovery route in Step 2 instead.

The user is still reading mail after the block

Outlook on the web and other sessions with a valid token can continue for up to an hour. Reset the password, use Revoke-MgUserSignInSession, and disable protocols with Set-CASMailbox if needed.

Changes are reverted in a hybrid tenant

Microsoft Entra Connect overwrites cloud-side changes made to a synchronised user. Make the change in on-premises Active Directory as well.

The licence cannot be removed

Remove any in-place hold or litigation hold from the user first. Microsoft requires holds to be removed before the licence is removed.

Offboarding checklist

Copy this list into your ticket template:

1. Agree mailbox, OneDrive and forwarding needs with the manager; check for legal holds.
2. Reset the password and select Sign out of all sessions; run Revoke-MgUserSignInSession for an immediate effect.
3. Block sign-in; optionally turn off mailbox protocols.
4. In hybrid tenants, apply the change on-premises too.
5. Save the mailbox: hold, export to .pst, convert to shared or forward.
6. Wipe and block mobile devices in the Exchange admin center.
7. Copy OneDrive files or add the manager as a site collection administrator.
8. Cancel the leaver's meetings and reassign owned groups, Teams and calling numbers.
9. Remove holds, then remove the licence.
10. Delete the account only when forwarding and shared mailbox are no longer needed.
11. Record the date: restoring a deleted account is possible for about 30 days.

References

• https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee?view=o365-worldwide
• https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-1?view=o365-worldwide
• https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-2?view=o365-worldwide
• https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-3?view=o365-worldwide
• https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-4?view=o365-worldwide
• https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-5?view=o365-worldwide
• https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-6?view=o365-worldwide
• https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-7?view=o365-worldwide
• https://learn.microsoft.com/en-us/microsoft-365/admin/email/convert-user-mailbox-to-shared-mailbox?view=o365-worldwide
• https://learn.microsoft.com/en-us/onedrive/set-retention
• https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users.actions/revoke-mgusersigninsession
• https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users/remove-mguser